Initial commit

This commit is contained in:
Your Name
2026-04-23 17:07:55 +08:00
commit b7e39e063b
16725 changed files with 1625565 additions and 0 deletions
@@ -0,0 +1,43 @@
# This is the sample configuration file to start new etcd
# single node cluster.
# Initial cluster state ('new' or 'existing').
ETCD_INITIAL_CLUSTER_STATE='new'
# Path to the data directory.
ETCD_DATA_DIR='/var/lib/etcd'
# Time (in milliseconds) of a heartbeat interval.
ETCD_HEARTBEAT_INTERVAL=100
# Time (in milliseconds) for an election to timeout.
ETCD_ELECTION_TIMEOUT=1000
# List of comma separated URLs to listen on for peer traffic.
ETCD_LISTEN_PEER_URLS=http://localhost:2380
# List of comma separated URLs to listen on for client traffic.
ETCD_LISTEN_CLIENT_URLS=http://localhost:2379
# List of this member's peer URLs to advertise to the rest of the cluster.
# The URLs needed to be a comma-separated list.
ETCD_INITIAL_ADVERTISE_PEER_URLS=http://localhost:2380
# List of this member's client URLs to advertise to the public.
# The URLs needed to be a comma-separated list.
ETCD_ADVERTISE_CLIENT_URLS=http://localhost:2379
# Enable info-level logging for etcd.
ETCD_LOG_LEVEL='info'
# Specify 'stdout' or 'stderr' to skip journald logging even when running under systemd.
ETCD_LOG_OUTPUTS='default'
# etcd is not officially supported on arm64
ETCD_UNSUPPORTED_ARCH='arm'
# Human-readable name for this member.
# ETCD_NAME='default'
# Initial cluster configuration for bootstrapping.
# ETCD_INITIAL_CLUSTER='default=http://localhost:2380'
@@ -0,0 +1,8 @@
FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
SRC_URI:append = " file://etcd-new.conf.sample"
do_install:append() {
install -m 0644 ${WORKDIR}/etcd-new.conf.sample -D -t ${D}${sysconfdir}
}
FILES:${PN}:append = " ${sysconfdir}/etcd-new.conf.sample"
@@ -0,0 +1,19 @@
SUMMARY = "C++ bindings for linux gpio APIs"
DESCRIPTION = "C++ bindings for linux gpio APIs."
HOMEPAGE = "http://github.com/openbmc/gpioplus"
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
SRCREV = "0f68a6ffdb42cd78c8f4641d21a76f015cc1a8d3"
PV = "0.1+git${SRCPV}"
PR = "r1"
SRC_URI = "git://github.com/openbmc/gpioplus;branch=master;protocol=https"
S = "${WORKDIR}/git"
inherit meson pkgconfig
EXTRA_OEMESON = " \
-Dexamples=false \
-Dtests=disabled \
"
@@ -0,0 +1,17 @@
SUMMARY = "Binary Encoded JSON library"
DESCRIPTION = "Used to decode Redfish Device Enablement (RDE) BEJ"
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
SRCREV = "dc3f214b7ec6157de289ac2366ded4e2d24bde35"
PV = "0.1+git${SRCPV}"
PR = "r1"
SRC_URI = "git://github.com/openbmc/libbej;branch=main;protocol=https"
S = "${WORKDIR}/git"
inherit meson pkgconfig
EXTRA_OEMESON = " \
-Dtests=disabled \
"
@@ -0,0 +1,11 @@
enforce_for_root
minlen=8
difok=0
lcredit=0
ocredit=0
dcredit=0
ucredit=0
minclass=2
usercheck=1
dictcheck=1
maxsequence=3
@@ -0,0 +1,12 @@
EXTRA_OECONF:append = " --enable-python-bindings=no"
RDEPENDS:${PN}:remove:class-target = " ${PYTHON_PN}-core"
FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
SRC_URI += " \
file://pwquality.conf \
"
do_install:append() {
install -d ${D}/etc/security
install -m 0644 ${WORKDIR}/pwquality.conf ${D}/etc/security
}
@@ -0,0 +1,10 @@
[Unit]
Description=Convert PAM config files
[Service]
RemainAfterExit=yes
Type=oneshot
ExecStart=/usr/bin/convert-pam-configs.sh
[Install]
WantedBy=multi-user.target
@@ -0,0 +1,48 @@
#!/bin/sh
# Convert OpenBMC linux-PAM config files
# Location of config files this script modifies:
# PAM_CONF_DIR - path to the PAM config files
# SECURITY_CONF_DIR - path to the security config files
PAM_CONF_DIR=/etc/pam.d
SECURITY_CONF_DIR=/etc/security
# Handle common-password:
# Change cracklib to pwquality and handle the minlen parameter
pam_cracklib=$(grep "^password.*pam_cracklib.so" ${PAM_CONF_DIR}/common-password)
if [ -n "${pam_cracklib}" ]
then
echo "Changing ${PAM_CONF_DIR}/common-password to use pam_pwquality.so (was pam_cracklib.so)" >&2
minlen=$(echo "${pam_cracklib}" | sed -e "s/.*minlen=\([[:alnum:]]*\).*/\1/")
echo " Converting parameter minlen=${minlen} to ${SECURITY_CONF_DIR}/pwquality.conf minlen" >&2
sed -i.bak -e "s/^minlen=.*/minlen=$minlen/" ${SECURITY_CONF_DIR}/pwquality.conf
pwquality='password [success=ok default=die] pam_pwquality.so debug'
sed -i.bak -e "s/^password.*pam_cracklib.so.*/$pwquality/" ${PAM_CONF_DIR}/common-password
echo "# This file was converted by $0" >>${PAM_CONF_DIR}/common-password
fi
# Handle common-auth:
# Change tally2 to faillock and handle the deny & unlock_time parameters
pam_tally2=$(grep "^auth.*pam_tally2.so" ${PAM_CONF_DIR}/common-auth)
if [ -n "${pam_tally2}" ]
then
echo "Changing ${PAM_CONF_DIR}/common-auth to use pam_faillock.so (was pam_tally2.so)" >&2
deny=$(echo "${pam_tally2}" | sed -e "s/.*deny=\([[:alnum:]]*\).*/\1/")
unlock_time=$(echo "${pam_tally2}" | sed -e "s/.*unlock_time=\([[:alnum:]]*\).*/\1/")
# Change faillock.conf parameters
echo " Converting parameter deny=${deny} to ${SECURITY_CONF_DIR}/faillock.conf deny" >&2
echo " Converting parameter unlock_time=${unlock_time} to ${SECURITY_CONF_DIR}/faillock.conf unlock_time" >&2
sed -i.bak \
-e "s/^deny=.*/deny=$deny/" \
-e "s/^unlock_time=.*/unlock_time=$unlock_time/" \
${SECURITY_CONF_DIR}/faillock.conf
# Change pam_tally2 to pam_faillock (changes the overall auth stack)
authfail='auth [default=die] pam_faillock.so authfail'
authsucc='auth sufficient pam_faillock.so authsucc'
sed -i.bak \
-e "/^auth.*pam_tally2.so.*$/d" \
-e "/^auth.*pam_deny.so/i $authfail\n$authsucc" \
${PAM_CONF_DIR}/common-auth
echo "# This file was converted by $0" >>${PAM_CONF_DIR}/common-auth
fi
@@ -0,0 +1,2 @@
deny=0
unlock_time=0
@@ -0,0 +1,28 @@
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system. The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.
#
# here are the per-package modules (the "Primary" block)
account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
-account [success=1 new_authtok_reqd=done default=ignore] pam_ldap.so ignore_unknown_user ignore_authinfo_unavail
# here's the fallback if no module succeeds
account requisite pam_deny.so
# Announce if faillock is blocking access
account required pam_faillock.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
@@ -0,0 +1,26 @@
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
# here are the per-package modules (the "Primary" block)
# Try for local user first, and then try for ldap
auth [success=2 default=ignore] pam_unix.so quiet
-auth [success=1 default=ignore] pam_ldap.so ignore_unknown_user ignore_authinfo_unavail
# Control gets here when no authentication module succeeds. Increment the
# failure tally and return failure status to PAM.
auth [default=die] pam_faillock.so authfail
# Control gets here when authentication succeeds. Check if the user is locked
# out due to consecutive authentication failures and return status accordingly.
auth sufficient pam_faillock.so authsucc
# If authsucc failed, deny access
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
@@ -0,0 +1,27 @@
#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords. The default is pam_unix.
# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords. Without this option,
# the default is Unix crypt. Prior releases used the option "md5".
#
# See the pam_unix manpage for other options.
# here are the per-package modules (the "Primary" block)
password [success=ok default=die] pam_pwquality.so debug
password [success=ok default=die] pam_ipmicheck.so spec_grp_name=ipmi use_authtok
password [success=ok ignore=ignore default=die] pam_pwhistory.so debug enforce_for_root remember=0 use_authtok
password [success=ok default=die] pam_unix.so sha512 use_authtok
password [success=1 default=die] pam_ipmisave.so spec_grp_name=ipmi spec_pass_file=/etc/ipmi_pass key_file=/etc/key_file
# here's the fallback if no module succeeds
password requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password required pam_permit.so
# and here are more per-package modules (the "Additional" block)
@@ -0,0 +1,19 @@
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# here are the per-package modules (the "Primary" block)
session [default=1] pam_permit.so
# here's the fallback if no module succeeds
session requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required pam_unix.so quiet
@@ -0,0 +1,83 @@
FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
SRC_URI += " file://pam.d/common-password \
file://pam.d/common-account \
file://pam.d/common-auth \
file://pam.d/common-session \
file://faillock.conf \
file://convert-pam-configs.service \
file://convert-pam-configs.sh \
"
inherit systemd
SYSTEMD_SERVICE:${PN} += "convert-pam-configs.service"
FILES:${PN} += "${bindir}/convert-pam-configs.sh \
${systemd_system_unitdir}/convert-pam-configs.service \
"
do_install:append() {
# The libpam recipe will always add a pam_systemd.so line to
# common-session if systemd is enabled; however systemd only
# builds pam_systemd.so if logind is enabled, and we disable
# that package. So, remove the pam_systemd.so line here.
sed -i '/pam_systemd.so/d' ${D}${sysconfdir}/pam.d/common-session
install -d ${D}/etc/security
install -m 0644 ${WORKDIR}/faillock.conf ${D}/etc/security
install -d ${D}${bindir}
install -m 0755 ${WORKDIR}/convert-pam-configs.sh ${D}${bindir}
install -d ${D}${systemd_system_unitdir}
install -m 0644 ${WORKDIR}/convert-pam-configs.service ${D}${systemd_system_unitdir}
}
RDEPENDS:${PN}-runtime += "libpwquality \
${MLPREFIX}pam-plugin-faillock-${libpam_suffix} \
${MLPREFIX}pam-plugin-pwhistory-${libpam_suffix} \
${MLPREFIX}pam-plugin-succeed-if-${libpam_suffix} \
${MLPREFIX}pam-plugin-localuser-${libpam_suffix} \
"
#
# Background:
# 1. Linux-PAM modules tally2 and cracklib were removed in libpam_1.5,
# which prompted OpenBMC to change to the faillock and pwquality modules.
# The PAM config files under /etc/pam.d were changed accordingly.
# 2. OpenBMC implementations store Redfish property values in PAM config files.
# For example, the D-Bus property maxLoginAttemptBeforeLockout is stored in
# /etc/pam.d/common-auth as the pam_tally2.so deny= parameter value.
# 3. The /etc directory is readonly and has a readwrite overlayfs. That
# means when a config file changes, an overlay file is created which hides
# the readonly version.
#
# Problem scenario:
# 1. Begin with a BMC that has a firmware image which has the old PAM
# modules and the old PAM config files which have modified parameters.
# For example, there is an overlay file for /etc/pam.d/common-auth.
# 2. Perform a firmware update to a firmware image which has the new PAM
# modules. The updated image will have not have the old PAM modules.
# It will have the new PAM config files in its readonly file system and
# the old PAM config files in its readwrite overlay.
# 3. Note that PAM authentication will always fail at this point because
# the old PAM config files in the overlay tell PAM to use the old PAM
# modules which are not present on the system.
#
# Two possible recoveries are:
# A. Factory reset the BMC. This will clear the readwrite overlay,
# allowing PAM to use the readonly version.
# B. Convert the old PAM config files to the new style. See below.
#
# Service: The convert-pam-configs.service updates the old-style PAM config
# files on the BMC: it changes uses of the old modules to the new modules
# and carries forward configuration parameters. A key point is that files
# are written to *only* as needed to convert uses of the old modules to the
# new modules. See the conversion tool for details.
#
# This service can be removed when the BMC no longer supports a direct
# firware update path from a version which has the old PAM configs to a
# version which has the new PAM configs.
#
# In case of downgrade, Factory reset is recommended. Current logic in existing
# images won't be able to take care of these settings during downgrade.
@@ -0,0 +1,21 @@
SUMMARY = "PAM modules for IPMI support"
DESCRIPTION = "PAM modules managing password for IPMI"
HOMEPAGE = "http://github.com/openbmc/pam-ipmi"
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
DEPENDS += "openssl libpam"
SRCREV = "565237cd0407695a2b37719f6574f544dd4e9ec5"
PV = "1.0+git${SRCPV}"
PR = "r1"
SRC_URI = "git://github.com/openbmc/pam-ipmi;branch=master;protocol=https"
S = "${WORKDIR}/git"
inherit meson pkgconfig
FILES:${PN} += " \
${base_libdir}/security/ \
${sysconfdir}/key_file \
${sysconfdir}/ipmi_pass \
"
@@ -0,0 +1,3 @@
$ModLoad imuxsock
$IncludeConfig /etc/rsyslog.d/*.conf
@@ -0,0 +1 @@
*.* /dev/null
@@ -0,0 +1,15 @@
FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
PACKAGECONFIG ??= " \
rsyslogd rsyslogrt inet regexp uuid \
${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)} \
"
SRC_URI += " \
file://rsyslog.conf \
file://server.conf \
"
do_install:append(){
install -m 0644 -D ${WORKDIR}/server.conf \
${D}${sysconfdir}/rsyslog.d/server.conf
}
@@ -0,0 +1,31 @@
SUMMARY = "sdbus++ dbus API / binding generator"
DESCRIPTION = "Generates bindings against sdbusplus for dbus APIs"
## The sdbusplus repository has an Apache LICENSE file, which we would
## normally check here, but the python setup script is in a subdirectory
## which requires us to set ${S} below. When we change ${S} from the root
## of the repository, bitbake can no longer find the LICENSE file. Point
## to the common Apache license file in poky's meta instead.
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://${COREBASE}/meta/files/common-licenses/Apache-2.0;md5=89aea4e17d99a7cacdbeed46a0096b10"
DEPENDS += " \
${PYTHON_PN}-inflection-native \
${PYTHON_PN}-mako-native \
${PYTHON_PN}-pyyaml-native \
"
PV = "1.0"
PYPI_PACKAGE = "sdbusplus"
S = "${WORKDIR}/git/tools"
inherit setuptools3
RDEPENDS:${PN} += " \
${PYTHON_PN}-inflection \
${PYTHON_PN}-mako \
${PYTHON_PN}-pyyaml \
"
include sdbusplus-rev.inc
BBCLASSEXTEND += "native nativesdk"
@@ -0,0 +1,6 @@
HOMEPAGE = "http://github.com/openbmc/sdbusplus"
PR = "r1"
PV ?= "1.0+git${SRCPV}"
SRC_URI += "git://github.com/openbmc/sdbusplus;branch=master;protocol=https"
SRCREV = "ae22c6ac5135cb2faafb076a22c0f2e6f5158068"
@@ -0,0 +1,23 @@
SUMMARY = "C++ bindings for systemd dbus APIs"
DESCRIPTION = "C++ bindings for systemd dbus APIs."
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
DEPENDS += " \
${PYTHON_PN}-inflection-native \
${PYTHON_PN}-mako-native \
${PYTHON_PN}-pyyaml-native \
boost \
systemd \
"
S = "${WORKDIR}/git"
inherit pkgconfig meson
inherit python3native
EXTRA_OEMESON:append = " \
-Dtests=disabled \
-Dexamples=disabled \
"
include sdbusplus-rev.inc
@@ -0,0 +1,23 @@
SUMMARY = "C++ bindings for systemd event APIs"
DESCRIPTION = "C++ bindings for systemd event APIs."
HOMEPAGE = "http://github.com/openbmc/sdeventplus"
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
DEPENDS += " \
stdplus \
systemd \
"
SRCREV = "25f484be0ede53f717a716604a0abdea8783a902"
PV = "0.1+git${SRCPV}"
PR = "r1"
SRC_URI = "git://github.com/openbmc/sdeventplus;branch=master;protocol=https"
S = "${WORKDIR}/git"
inherit meson pkgconfig
EXTRA_OEMESON = " \
-Dexamples=false \
-Dtests=disabled \
"
@@ -0,0 +1,31 @@
SUMMARY = "Common C++ functions"
DESCRIPTION = "Common C++ functions."
HOMEPAGE = "http://github.com/openbmc/stdplus"
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"
DEPENDS += " \
function2 \
fmt \
liburing \
"
SRCREV = "e6fda4501899d9d886f9d5c035f4cf759b459861"
PV = "0.1+git${SRCPV}"
PR = "r1"
SRC_URI = "git://github.com/openbmc/stdplus;branch=master;protocol=https"
S = "${WORKDIR}/git"
inherit meson pkgconfig
EXTRA_OEMESON = " \
-Dexamples=false \
-Dtests=disabled \
-Dgtest=disabled \
"
PACKAGES =+ "libstdplus libstdplus-dl libstdplus-io_uring"
FILES:libstdplus = "${libdir}/libstdplus.so.*"
FILES:libstdplus-dl = "${libdir}/libstdplus-dl.so.*"
FILES:libstdplus-io_uring = "${libdir}/libstdplus-io_uring.so.*"
@@ -0,0 +1,2 @@
PACKAGECONFIG:remove:openbmc-phosphor = "gnutls"
PACKAGECONFIG:append:openbmc-phosphor = " openssl"